URLhaus: malware_download Malicious URLs

Hunt Hypothesis

This hypothesis targets adversaries who establish command-and-control channels by directing hosts to download malicious payloads from known URLhaus entries, a common precursor to initial access or privilege escalation. Proactively hunting for these specific malware_download URLs in Azure Sentinel allows the SOC to identify compromised endpoints early, preventing the execution of malicious binaries before they can propagate or establish persistence within the environment.

IOC Summary

Threat: malware_download Total URLs: 4 Active URLs: 4

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: malware_download
let malicious_domains = dynamic(["176.119.79.164", "115.61.112.176"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["176.119.79.164", "115.61.112.176"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

• Scenario: A DevOps engineer uses a CI/CD pipeline (e.g., GitHub Actions or Jenkins) to download a specific build artifact or dependency from a staging repository that has been temporarily flagged by URLhaus due to a shared IP or recent compromise, but the artifact itself is verified via checksum.
  • Filter/Exclusion: Exclude URLs where the User-Agent string matches known CI/CD agents (e.g., github-actions, jenkins) or where the download source IP is within the internal staging network range (e.g., 10.20.0.0/24).
• Scenario: An IT administrator performs a manual software deployment using a script that downloads a patch or installer from a vendor’s temporary distribution link (e.g., https://downloads.vendor.com/temp/patch-1.2.3.exe) which is listed on URLhaus because it was used in a recent campaign, but the file is signed and verified.
  • Filter/Exclusion: Exclude URLs that end with common executable extensions (.exe, .msi, .zip) when the initiating process is a known administrative tool (e.g., powershell.exe, psexec.exe) and the URL domain matches an approved vendor list (e.g., *.vendor.com).
• Scenario: A security team runs a YARA rule or IOC hunt that intentionally fetches a known malicious URL from a sandbox or isolated test VM to validate detection logic, causing the URL to appear in production logs if the test environment shares a network segment.
  • Filter/Exclusion: Exclude events where the source host is tagged as environment=test or role=sandbox in CMDB, or where the destination port is 443 and the source IP is within the dedicated security lab subnet (e.g., `192.168.50.0/2